Critical FortiSandbox Under Attack: CISA Orders Urgent Patching

What happened?

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in FortiSandbox to its Known Exploited Vulnerabilities (KEV) catalog, indicating they are being actively exploited. These are CVE-2026-39808 and CVE-2026-25089, both with a CVSS score of 9.1. These OS command injection flaws allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests, without needing credentials or user interaction. Inclusion in the KEV catalog means CISA has evidence of active exploitation, though it typically does not attribute attacks or disclose their scope. Fortinet, for its part, has not confirmed active exploitation nor updated its security advisories to mark these vulnerabilities as exploited.

Why is it important?

FortiSandbox is a widely deployed sandboxing solution in enterprise and government environments for analyzing and detecting malware. Its compromise could allow attackers to evade threat detection, access internal networks, and execute malicious code. Exploitation of these vulnerabilities could lead to full device control, exposing sensitive data and enabling lateral movement within the network. Inclusion in CISA's KEV catalog means federal civilian agencies must patch within the timelines set by Binding Operational Directive 26-04 or disconnect vulnerable systems. Although the directive is only binding for federal entities, all organizations are recommended to prioritize this update. This event recalls previous incidents such as the exploitation of FortiOS vulnerabilities (CVE-2018-13379) that affected tens of thousands of devices, or the recent ransomware campaign that exploited flaws in FortiGate. The difference here is that FortiSandbox is a security solution, so its compromise is particularly serious, as attackers can blind the organization's defenses.

Technical details

Fortinet released patches for CVE-2026-39808 in April and for CVE-2026-25089 in June 2026, warning in their advisories that successful exploitation could lead to remote code execution via low-complexity attacks. However, security firm Defused has reported observing exploitation attempts against both flaws this same week, along with another FortiSandbox vulnerability, CVE-2026-39813. Interestingly, the exploit targeting CVE-2026-25089 has been described as 'vibecoded' and likely faulty, with no functional public exploit seen so far. This suggests attackers are experimenting, and a functional exploit could emerge at any time. The vulnerabilities affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS, expanding the attack surface. The CVSS score of 9.1 indicates high criticality, and the lack of authentication requirements makes these flaws especially attractive to attackers.

Consequences and recommendations

Organizations using FortiSandbox should apply available patches immediately. Additionally, monitor systems for suspicious activity, such as unusual incoming connections or unauthorized command execution. Network segmentation can limit potential impact, and reviewing audit logs for signs of compromise is recommended. CISA has also added a critical vulnerability in Microsoft SharePoint Server (CVE-2026-58644) to the KEV catalog, with a CVSS score of 9.8, allowing authenticated attackers with site owner privileges to execute arbitrary code remotely. Microsoft warned that this vulnerability can be exploited over the internet with relatively little effort, making it a patching priority. The combination of these threats underscores the importance of maintaining a robust vulnerability management program and responding quickly to cybersecurity alerts.

The active exploitation of these vulnerabilities underscores the importance of keeping systems updated and having rapid response processes for cybersecurity alerts. In a landscape where attackers increasingly exploit known flaws, patching speed is a critical factor for defense.